Install GlobalProtect for IoT on Windows
Devices running Windows 10 IoT can use the
GlobalProtect app. Use your organization’s distribution method,
such as Microsoft System Center Configuration Manager (SCCM), to
deploy and install the GlobalProtect app on your IoT devices running
Windows 10 IoT Enterprise.
A GlobalProtect Windows IoT deployment
supports certificate-based authentication. You must install the
certificate used for authentication on each IoT device in its local
machine store. If an IoT device has multiple certificates with the
same Root CA, GlobalProtect uses the first certificate in the IoT
device’s local machine store to authenticate; be sure that your
certificates are in the correct order in your devices.
The
following sections describe how to install the GlobalProtect app
on devices running Windows IoT:
Download
and Install the MSIEXEC File on the IoT Device
You can download and install the
msiexec.exe
file
to your IoT devices to install the GlobalProtect app for the On-Demand
connect
method or Always On
connect method. You use the same method
to deploy the msiexec.exe
file as you do on a non-IoT device.Modify
the Registry Keys on the IoT Device (On-Demand or Always On)
You must specify the OS type as IoT, the device
type as headless, and the portal address. Optionally, you can specify
a username and password. If you do not specify a username and password,
GlobalProtect uses certificate-based authentication.
You
can use the following methods of installation for the
On-Demand
connect
method or Always On
connect method:- Specify the OS Type (Required):Registry subkey:\HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\SettingsName:os-typeType:REG_SZData:IoT
- Specify a headless IoT device (Required):Registry subkey:\HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\SettingsName:head-lessType:REG_SZData:yes
- Specify the portal address (Required):Registry subkey:\HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetupName:PortalType:REG_SZData: Enter the GlobalProtect portal’s IP address or FQDN.
- Specify the username (Optional):Registry subkey:\HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\SettingsName:usernameType:REG_SZData: Enter the user name to use with the IoT device.
- Specify the password (Optional):Registry subkey:\HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\SettingsName:passwordType:REG_SZData: Enter the password to use with the IoT device.
Modify
the Registry Keys on the IoT Device (Always On with Pre-logon)
You must specify the portal address, the pre-logon timeout
value, and the service-only value. You must delete the GlobalProtect
value to prevent the IoT device from automatically launching the
app interface upon system restart. A pre-logon VPN tunnel does not
associate the username because the user has not logged in.
You
can use the following methods of installation for the
Pre-logon (Always
On)
connect method:- Specify the portal address (Required):Registry subkey:\HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetupName:PortalType:REG_SZData: Enter the GlobalProtect portal’s IP address or FQDN.
- Specify the pre-logon value (Required):Registry subkey:\HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\PanSetupName:PrelogonType:REG_SZData:1
- Specify the service-only value (Required):Registry subkey:\HKEY_LOCAL_MACHINE\SOFTWARE\Palo Alto Networks\GlobalProtect\SettingsName:service-onlyType:REG_SZData:yes
- Delete the GlobalProtect value (Required):Registry subkey:\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunName:GlobalProtectType:REG_SZ
Recommended For You
Recommended Videos
Recommended videos not found.